Providing application visibility for micro-segmentation of a network deployment

Abstract

A method of creating micro-segmentation policies for a network is provided. The method identifies a set of network nodes as seed nodes. The method monitors network packet traffic flows for the seed nodes to collect traffic flow information. The method identifies a set of related nodes for the set of seed nodes based on the collected network flow information. The method analyzes the collected network flow information to identify micro-segmentation policies for the network.

Description

BACKGROUND[0001]Datacenters or cloud environments have traditionally been secured by emphasizing perimeter protection to keep outside threats from affecting the entities within the network. Security services such as firewall were provided at the perimeter to monitor the north-south traffic (i.e., the traffic exchanged with the outside environment) and detect the outside threats.[0002]In a multi-tenant environment, different host machines host virtual machines (VMs) for different users (or tenants). In some cases, several logically separated workloads (or guest) VMs of different tenants operate on a single host. In such shared environments, security services (as well as other services) must be applied within the datacenter, not only against external threats, but also from threats of other machines within the datacenter or other VMs running on the same host. In some such cases, the services are distributed and enforced throughout the network. For example, a distributed firewall provid...

AI Technical Summary

Benefits of technology

[0008]The flows are then reduced by morphing a large number of flows into smaller groups of related flows. Firewall rules for the smaller groups of flows are then created either automatically or through user interactions. The rules are then presented for review (e.g., by getting approval from a security administrator). The rules are then enforced by publishing the rules into the current firewall rule table.

[0009]Some embodiments provide a method that is used in an environment that hosts a set of applications (e.g., three tiered enterprise applications) and generates a network topolog

Problems solved by technology

Deploying micro-segmentation with appropriate policies, however, is turning out to be a challenging proposition.

Since most enterprise applications are not documented in terms of the intra-application communications, the security teams are not aware of all components that constitute the application, and more importantly the internal communications that actually happens across the application components.

In addition, the application developers that built an original application may have moved on, making authoritative application behavior determination a challenging task.

Other than this port that needs to be opened, th

Images